diff -uNr xen-unstable.hg/xen/arch/x86/hvm/vmx/vmx.c xen-unstable.hg-patched/xen/arch/x86/hvm/vmx/vmx.c
--- xen-unstable.hg/xen/arch/x86/hvm/vmx/vmx.c	2008-06-25 13:29:14.000000000 +0100
+++ xen-unstable.hg-patched/xen/arch/x86/hvm/vmx/vmx.c	2008-06-26 19:11:34.953395499 +0100
@@ -1523,7 +1523,8 @@
         break;
     case VMX_CONTROL_REG_ACCESS_TYPE_LMSW:
         value = v->arch.hvm_vcpu.guest_cr[0];
-        value = (value & ~0xFFFF) | ((exit_qualification >> 16) & 0xFFFF);
+        /* lsmw can set but never clear PE */
+        value = (value & 0xFFFF0001) | ((exit_qualification >> 16) & 0xFFFF);
         HVMTRACE_LONG_1D(LMSW, current, value);
         return !hvm_set_cr0(value);
     default:
diff -uNr xen-unstable.hg/xen/arch/x86/x86_emulate/x86_emulate.c xen-unstable.hg-patched/xen/arch/x86/x86_emulate/x86_emulate.c
--- xen-unstable.hg/xen/arch/x86/x86_emulate/x86_emulate.c	2008-06-25 13:29:14.000000000 +0100
+++ xen-unstable.hg-patched/xen/arch/x86/x86_emulate/x86_emulate.c	2008-06-26 19:10:54.358858499 +0100
@@ -3284,7 +3284,7 @@
             else if ( (rc = ops->read(ea.mem.seg, ea.mem.off,
                                       &cr0w, 2, ctxt)) )
                 goto done;
-            cr0 &= 0xffff0000;
+            cr0 &= 0xffff0001; /* lmsw can set, but never clear, PE */
             cr0 |= (uint16_t)cr0w;
             if ( (rc = ops->write_cr(0, cr0, ctxt)) )
                 goto done;